Back to Details

d3fend-model

Compare original and translation side by side

🇺🇸

Original

English
🇨🇳

Translation

Chinese

D3FEND — Model

D3FEND — 建模

When to Use

适用场景

  • Building or auditing asset inventories (hardware, software, network, data)
  • Mapping network topology and logical/physical links
  • Running vulnerability assessments and enumerating exposures
  • Modeling operational dependencies and service mappings
  • Assessing organizational cyber risk posture
  • Analyzing container images and configurations
  • 构建或审计资产清单（硬件、软件、网络、数据）
  • 绘制网络拓扑及逻辑/物理链路
  • 开展漏洞评估并枚举暴露风险
  • 建模运营依赖关系及服务映射
  • 评估组织网络安全风险态势
  • 分析容器镜像及配置

When NOT to Use

不适用场景

  • Implementing hardening controls → 
    d3fend-harden
  • Designing detection rules or monitoring → 
    d3fend-detect
  • Network segmentation or access mediation → 
    d3fend-isolate
  • Incident response or eviction actions → 
    d3fend-evict
  • General enterprise security program design → 
    cybersecurity
  • 实施加固控制 → 
    d3fend-harden
  • 设计检测规则或监控方案 → 
    d3fend-detect
  • 网络分段或访问管控 → 
    d3fend-isolate
  • 事件响应或清除操作 → 
    d3fend-evict
  • 通用企业安全方案设计 → 
    cybersecurity

Core Workflows

核心工作流

1. Asset Inventory

1. 资产清单

Asset TypeWhat to CaptureTools
HardwareDevices, firmware, componentsLansweeper, Nmap, agent-based discovery
SoftwareInstalled apps, versions, licensesSCCM, osquery, SBOM tools
NetworkNodes, interfaces, VLANsNmap, SNMP, network scanners
DataDatabases, file stores, sensitivityData classification tools
ContainersImages, registries, runtime inventoryTrivy, Docker Scout, Kubernetes APIs
See 
references/asset_inventory.md
资产类型需捕获内容工具
硬件设备、固件、组件Lansweeper、Nmap、基于Agent的发现工具
软件已安装应用、版本、许可证SCCM、osquery、SBOM工具
网络节点、接口、VLANNmap、SNMP、网络扫描器
数据数据库、文件存储、敏感度数据分类工具
容器镜像、镜像仓库、运行时清单Trivy、Docker Scout、Kubernetes APIs
详见 
references/asset_inventory.md

2. Network Mapping

2. 网络映射

  • Logical: Layer 3 topology, routing paths, traffic policies
  • Physical: Cable runs, rack layouts, wireless coverage
  • Active: Scanning, probing, traceroute
  • Passive: NetFlow, ARP tables, DHCP logs
See 
references/network_mapping.md
  • 逻辑层面：三层拓扑、路由路径、流量策略
  • 物理层面：线缆走向、机架布局、无线覆盖范围
  • 主动方式：扫描、探测、 traceroute
  • 被动方式：NetFlow、ARP表、DHCP日志
详见 
references/network_mapping.md

3. Vulnerability Assessment

3. 漏洞评估

  1. Discovery → asset inventory
  2. Scanning → Nessus, Qualys, OpenVAS
  3. Analysis → CVSS scoring, exploitability, exposure
  4. Prioritization → threat intel, asset criticality
  5. Reporting → remediation timelines
See 
references/vulnerability_assessment.md
  1. 发现 → 资产清单
  2. 扫描 → Nessus、Qualys、OpenVAS
  3. 分析 → CVSS评分、可利用性、暴露程度
  4. 优先级排序 → 威胁情报、资产重要性
  5. 报告 → 修复时间线
详见 
references/vulnerability_assessment.md

4. Dependency & Risk Mapping

4. 依赖关系与风险映射

  • Service dependencies: upstream/downstream services
  • Operational: business process → IT asset mapping
  • Data exchange: flows, interfaces, protocols
  • Access modeling: who can access what
See 
references/dependency_risk_mapping.md
  • 服务依赖：上游/下游服务
  • 运营层面：业务流程→IT资产映射
  • 数据交换：流向、接口、协议
  • 访问建模：权限访问范围
详见 
references/dependency_risk_mapping.md

When to load references

何时加载参考文档

  • Asset inventory → 
    references/asset_inventory.md
  • Network mapping → 
    references/network_mapping.md
  • Vulnerability assessment → 
    references/vulnerability_assessment.md
  • Dependency & risk mapping → 
    references/dependency_risk_mapping.md
  • 资产清单 → 
    references/asset_inventory.md
  • 网络映射 → 
    references/network_mapping.md
  • 漏洞评估 → 
    references/vulnerability_assessment.md
  • 依赖关系与风险映射 → 
    references/dependency_risk_mapping.md